Prove automatic Kubernetes worker failure recovery

[RicheyWorks]

Outcome

• preserve the operator-remediated abrupt worker-loss proof and add a separate automatic failure-detection phase
• pin the disposable cluster to a 20-second node-monitor grace period and all qualification workloads to 10-second not-ready/unreachable NoExecute tolerations
• kill a worker without drain or post-failure Kubernetes remediation, then bound node detection, EndpointSlice withdrawal, pod eviction, degraded traffic, fresh-identity recovery, and two-zone traffic distribution
• advance the fail-closed topology profile/evidence schema to 7 and reject 83 unsafe profile variants

Verification

• focused KubernetesLiveTopologyContractTest passed
• full Maven suite passed: 2,694 tests, 0 failures/errors/skips
• both changed shell scripts pass bash -n from the normalized Git index
• JSON profile parsing and git diff --check passed

Evidence boundary

This is a disposable loopback kind proof with test-configured controller timing. It does not establish deployment-equivalent failure timing, external ingress behavior, capacity, registry integrity, or production readiness. Exact-head CI must run the live kind phase.